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This memorandum transmits Deloitte and Touche LLP's Management Letter of the 
Export-Import Bank of the United States (Ex-Im Bank] financial statements for fiscal 
year ended 2013. Under a contract monitored by this office, we engaged the 
independent public accounting firm of Deloitte and Touche to perform the audit. 
The contract required the audit to be done in accordance with: United States 
generally accepted government auditing standards; Office of Management and 
Budget audit guidance; and the Government Accountability Office/President's 
Council on Integrity and Efficiency Financial Audit Manual. 

Deloitte and Touche identified deficiencies related to the Ex-Im Bank's internal 
control over financial reporting and other matters that needed your attention. The 
observations, recommendations, and your responses regarding such matters are 
presented in the Attachment. 

Deloitte and Touche is responsible for the attached management letter dated March 
19, 2014 and the conclusions expressed in the letter. We do not express opinions on 
Ex-Im Bank's financial statements or internal control or conclusions on compliance 
with laws and regulations. 

We appreciate the cooperation and courtesies provided to Deloitte and Touche and 
this office during the audit. If you have questions, please contact Julie Wong, 
[202] 565-3920 Tulie.Wong@exim.gov. or me at [202] 565-3499 
Arturo.Cornejo@exim.gov . You can obtain additional information about the Export- 
Import Bank Office of Inspector General and the Inspector General Act of 1978 at 
www.exim.gov/oig . 
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March 21, 2014 
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cc: Fred Hochberg, Chairman and President 

C.J. Hall, Executive Vice President and Chief Risk Officer 

Michael Cushing, Senior Vice President and Chief Operating Officer 

Audit Committee 

Nathalie Herman, Treasurer, Office of the Chief Financial Officer 
Patricia Wolf, Controller, Office of the Chief Financial Office 
John Lowry, Director, Information Technology Security and Systems 
Assurance 

Inci Tonguch-Murray, Business Compliance Officer 
Duncan Barks, Partner, Deloitte and Touche LLP 



811 Vermont Avenue, NW Washington, D.C. 20571 



Deloitte 



Deloitte & Touche LLP 

1750 Tysons Blvd. 
McLean, VA 22102-4219 
USA 

Tel: +1 703 251 1000 
Fax: +1 703 251 3400 
vwwv.deloitte.com 



March 19,2014 

Management of the Export-Import Bank of the United States 
8 1 1 Vermont Avenue N W 
Washington, D.C. 20571 

Dear Members of Management: 

In planning and performing our audit of the financial statements of the Export-Import Bank of the United 
States ("Ex-Im Bank 55 ) as of and for the year ended September 30, 2013 (on which we have issued our 
report dated December 12 , 2013), in accordance with auditing standards generally accepted in the United 
States of America, the standards applicable to the financial audits contained in the Government Auditing 
Standards, issued by the Comptroller General of the United States, and Office of Management and the 
Budget Bulletin No. 14-02, Audit Requirements for Federal Financial Statements, as amended, we 
considered the Ex-Im Bank's internal control over financial reporting as a basis for designing audit 
procedures that are appropriate in the circumstances, but not for the purpose of expressing an opinion on 
the effectiveness of the Ex-Im Bank's internal control over financial reporting. Accordingly, we do not 
express an opinion on the effectiveness of the Ex-Im Bank's internal control over financial reporting. This 
report is based on our knowledge as of the date of our report on the financial statements, obtained in 
performing our audit thereof, and should be read with that understanding. 

Our consideration of internal control over financial reporting was for the limited purpose described in the 
preceding paragraph and was not designed to identify all deficiencies in internal control over financial 
reporting. However, in connection with our audit, we identified, and included in the attached Appendix A, 
deficiencies related to the Ex-Im Bank's internal control over financial reporting and other matters as of 
September 30, 2013, that we wish to bring to your attention. 

Based on our audit work, we believe management adequately addressed the deficiencies reported in our 
fiscal year (FY) 2012 management letter (see Appendix B). 

The definition of a deficiency is also set forth in the attached Appendix A. 

Although we have included management's written response to our comments in Section I , such responses 
have not been subjected to the auditing procedures applied in our audit of the financial statements and, 
accordingly, we do not express an opinion or provide any form of assurance on the appropriateness of the 
responses or the effectiveness of any corrective actions described therein. 

This report is intended solely for the information and use of management, the Audit Committee, the 
Inspector General, and others within the organization and is not intended to be, and should not be, used by 
anyone other than these specified parties. 



cc: The Inspector General of the Export-Import Bank of the United States and the Audit Committee of the 
Export-Import Bank of the United States 



Yours truly, 





Member of 

Deloitte Touche Tohmatsu Limited 



APPENDIX A 



SECTION I — DEFICIENCIES 

We identified, and have included below, deficiencies involving the Ex-Im Bank's internal control over 
financial reporting for the period from October 1, 2012 through September 30, 2013 that we wish to bring 
to your attention. 

Incorrect Maturity Dates of Working Capital Guarantee Transactions 

Condition: 

Ex-Im Bank identified that maturity dates for some of the working capital guarantee transactions 
authorized during FY 2012 and 2013 were inaccurate. We identified 122 working capital guarantee 
transactions authorized during FY 2012 as inaccurate. For FY 2013 transactions, management made 
corrections prior to audit testing. We found no exceptions for FY 2013 transactions after corrections made 
by management. 

Criteria: 

The maturity dates of working capital guarantee transactions should be correctly reflected on the Ex-Im 
Bank's portfolio. Additionally, sufficient controls should be in place to timely detect errors identified in 
the entry of such information. 

Cause: 

Due to inappropriate supervision and review, a staff member had been entering the maturity dates for new 
working capital guarantees into the Loans and Guarantees Accounting System (LGA) incorrectly. The 
staff entered the maturity date based on six months after the authorization date instead of six months after 
the final disbursement date or expiration date. 

Effect or Potential Effect: 

The incorrect working capital guarantee maturity dates resulted in exclusions of some working capital 
guarantees from Ex-Im Bank's 2012 portfolio. This resulted in an understatement of 2012 working capital 
guarantees exposure and the allowance for working capital guarantees of approximately $495 million 
(0.5% of the FY 2012 total portfolio exposure) and $2.9 million (0.2% of FY 2012 loan guarantee 
liability), respectively. Ex-Im Bank did not correct the 2012 financial statements as they were considered 
to be immaterial by Ex-Im Bank. We concurred with Ex-Im Bank's conclusion not to correct 2012 
exposure. The maturity dates for transactions authorized during FY 2013 were corrected as of 
September 30, 2013. 

Recommendation: 

We recommend Ex-Im Bank enhances the review process of the working capital guarantee information 
entered by staff members. Additionally, management should communicate accounting policy and 
procedures regarding working capital transactions to staff members. Specifically, by creating a desk 
procedure that would effectively communicate policy and procedures to new staff members. 



Management Response: 



Management agrees with the recommendation. Additional training on accounting policies and bank 
procedures has been provided to staff members by department supervisors, before and after the error 
occurred. Management will maintain a focus of improving efficiency in the review process and in the 
standard operating procedure to ensure consistency and accuracy. Management will continue to 
communicate and update staff on any changes in the accounting policy and procedures should they 
change in the future. 

Incorrect Late Interest Calculation 

Condition: 

We identified that the late interest was incorrectly calculated due to inaccurate invoice received dates, 
lack of time stamp on invoices received, and inconsistencies in selecting appropriate invoice received 
dates in the event that a proper time stamp was missing. 

Criteria: 

The late interest for vendor invoices should be calculated as instructed by the Prompt Payments Act (5 
CFR Part 1315), which states that interest will accrue from the day after the payment due date, until the 
payment date. The payment due date is deemed the later of the date the invoice is received and stamped, 
or seven days after the goods are received or services delivered. 

Cause: 

There was a lack of policy in place to provide proper guidance on appropriate invoice dates for the 
purpose of late interest calculation according to the Prompt Payment Act. 

Effect or Potential Effect: 

Interest expenses related to late payment could have been understated by approximately $12,000 as of 
September 30, 2013. Ex-Im Bank implemented a plan to ensure proper time stamp and consistent invoice 
received dates as of September 30, 2013. 

Recommendation: 

We recommend that Ex-Im Bank institutes specific policies for the application of proper invoice date 
according to the Prompt Payment Act to ensure adherence to these policies. Ex-Im Bank should 
implement proper controls to ensure the correct invoice dates are entered. 

Management Response: 

Management agrees with the recommendation. Management has installed two new stamping machines to 
counter equipment failure and has implemented a new process that requires staff to date-stamp the 
invoices that are processed. This will ensure that invoices have the proper date in accordance with the 
Prompt Payment Act. In addition, the Office of Contracting (OCS) and the Office of Administrative 
Services (OAS) supplied additional training to staff members on the importance of date-stamping 
incoming invoices in accordance with the Prompt Payment Act. 



Inaccurate Subsidy Re-estimate Journal Entries 

Condition: 

During our testing of the subsidy re-estimate journal entry, the following errors were noted: 

1) Ex-Im Bank identified that the FY 2013 subsidy re-estimate journal entry was incorrectly recorded. 
The guarantee provision was incorrectly recorded as insurance provision. 

2) We identified that the subsidies for guarantee and insurance transactions were correctly calculated. 
However, the subsidies for the cohort year 2012 for insurance and guarantee transactions were not 
included in the subsidy re-estimate journal entry and therefore were not recorded. 

Ex-Im Bank recorded correcting journal entries to correct the errors as of September 30, 2013. 

Criteria: 

The subsidy re-estimate journal entry should be recorded correctly according to accurate information and 
calculations according to the Expected Loss Model developed by Ex-Im Bank. 

Cause: 

The subsidy re-estimate spreadsheet used to calculate the total subsidies had an incorrect formula which 
was not detected upon review. Additionally, the subsidy for guarantees was incorrectly recorded as 
subsidy for insurance due to human error. 

Effect or Potential Effect: 

The downward and upward subsidies were understated by approximately $80 and $10 million, 
respectively at September 30, 2013. Ineffective review of the journal entries prior to posting could 
potentially cause an incorrect subsidy re-estimate journal entry and therefore an inaccurate subsidy 
recorded in the financial statements. The errors were corrected by Exlm Bank as of September 30, 2013. 

Recommendation: 

We recommend that a more comprehensive review of the subsidy re-estimate spreadsheet, as well as the 
journal entry, be performed to detect any material misstatements in a timely manner. 

Management Response: 

Management agrees with the recommendation. The Office of the Chief Financial Officer is implementing 
a comprehensive review of the inputs and outputs of the calculation. Management continues to provide 
training to staff on the importance of a detailed review process that is conducted in a timely manner. 

Incorrect Interest Rate used in the Calculation of the Subsidy Re-estimate 

Condition: 

During our testing of the FY 2013 subsidy re-estimate, we identified that incorrect interest rates for 
medium term and long term guarantees were utilized in the subsidy macro input table. 



Criteria: 



The subsidy re-estimate calculation macro should use the correct interest rate in order to calculate the 
subsidy accurately. 

Cause: 

Due to deficient review process, the interest rates for medium term and long term guarantees were 
incorrectly entered into the input table by the financial analyst. The incorrect rate were not identified in a 
timely manner. 

Effect or Potential Effect: 

The total provision was misstated by approximately $22 million. Ex-Im Bank made corrections to the 
interest rate in the macro input table and recalculated the subsidy for FY 2013. Accordingly, Ex-Im Bank 
recorded an adjustment to accurately reflect the provisions at September 30, 2013. 

Recommendation: 

We recommend that Ex-Im Bank perform a more comprehensive review of the inputs used in the macro 
prior to performing the calculation of the subsidy re-estimate. 

Management Response: 

Management agrees with the recommendation. The Office of the Chief Financial Officer is implementing 
a comprehensive review of the inputs and outputs of the calculation. Management continues to provide 
training to staff on the importance of a detailed review process that is conducted in a timely manner. 

Inaccurate Rescheduled Loans Balance 

Condition: 

We identified a rescheduled loan which was recorded inaccurately in the LGA. The rescheduled loan 
identified by us maintained an outstanding balance of approximately $983,000 when it should be written 
off by Ex-Im Bank. 

Criteria: 

Only rescheduled loans for which future cash flows are expected should be included in the records of Ex- 
Im Bank. 

Cause: 

Due to insufficient review, a journal entry to write-off a rescheduled loan was recorded inaccurately. 
Effect or Potential Effect: 

The rescheduled loan balance was overstated by approximately $983,000. This error was determined 
immaterial by Ex-Im Bank and no correction was made. We concurred with Ex-Im Bank's conclusion. 
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Recommendation: 



We recommend that controls be implemented to ensure that the proper journal entry is recorded to write 
off the rescheduled loan. 

Management Response: 

Management agrees with the recommendation. In an effort to ensure accuracy in the write off process, 
Management will implement a control of cross checking the Rescheduled Loan (R-Loan) report on a 
periodic basis against known qualitative data and corresponding information. Management will continue 
to monitor the report and provide additional training if needed. 

Inappropriate Evidence or Inappropriate Assignment of Transactions for Risk Rating 

Condition: 

During our testing of risk rating, we identified inaccurate assignment of transactions within the Portfolio 
Monitoring and Control Group's (PMCG) non-core transactions and short-term single buyer insurance 
transactions. 

Criteria: 

BCL ratings should be re-evaluated annually according to the FY 2013 Restimate Process. BCL ratings 
should accurately reflect the underlying risk of a transaction/borrower. 

Cause: 

Due to miscommunication among monitoring division, the following were noted: 

1) Five short-term single buyer insurance were evaluated as private instead of non-sovereign 
transactions. 

2) Due to miscommunication, one medium term guarantee was not assigned to an appropriate 
monitoring division. Therefore, the BCL for the borrower was not properly evaluated. 

Effect or Potential Effect: 

Allocating an inaccurate BCL rating to a borrower could result in a misstatement in the subsidy re- 
estimate. Ex-Im Bank reviewed the transactions identified by D&T and concluded that the BCL rating 
was appropriate despite the incorrect allocation. 

Recommendation: 

We recommend as a part of the annual risk rating process Ex-Im Bank perform a review of transactions in 
the portfolio to ensure that they are assigned to appropriate monitoring divisions. 

Management Response: 

Management agrees with the recommendation. Management is conducting a comprehensive review of 
work-flow between the various divisions to ensure that credits are assigned to the appropriate monitoring 
divisions. Every transaction or credit is unique and may not fit into a standardized mold, but management 
will continue to work to improve the process in place. 
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User Access Rights Review 



Condition: 

We inspected the documentation for the January 2013 annual access rights review and noted that one 
(1) user requested to be removed from access by management maintained access to EXIM Online as of 
August 1, 2013. The one user noted was from a sample of five selections selected for our testing. 

Criteria: 

Management's requests for access changes related to the annual access reviews at Ex-Im should be 
addressed in a timely manner, and in the specific event access removals are requested, they should be 
revoked as soon as possible. 

Cause: 

Due to a human error, and insufficient review, the individual responsible for making access change did 
not remove a user's access after his review of the change request. 

Effect or Potential Effect: 

If access privileges are not established effectively, data integrity, confidentiality, and availability may be 
compromised through intentional or unintentional errors. Without effective and timely reviews, there will 
be no assurance that user access privileges remain appropriate, or that logical security is effective. 
Additionally, potential threats and misuse may not be timely noted. After this exception was identified, 
management reviewed and removed the user's access (within EXIM Online) as evidenced through testing 
on September 5, 2013 and September 19, 2013. 

Recommendation: 

While Ex-Im Bank remediated the user access exception, we recommend that Ex-Im Bank continue to 
focus on the execution of access changes in relation to the annual access review and perform a 
confirmation process after the annual access review to ensure that all required changes were completed 
according to the access request. This control assists in the overall effectiveness of Ex-Im Bank's process 
for user account administration. 

Management Response: 

Management agrees with the recommendation. The confirmation process after the annual Access Control 
Review (ACR) has been completed and is being executed during the ongoing ACR cycle for FY 14 (now 
underway since November 2013). Management has determined that there is nothing intrinsic in the failure 
to modify the account identified in the finding that exposed the Bank to any additional security risk that 
affects the confidentiality, integrity, and availability of the Bank's critical information. Management will 
continue to monitor and provide additional controls if needed. 



SECTION II — OTHER MATTERS 

Refer to Appendix B below for the status of the FY 2012 management letter comments. 
SECTION III — DEFINITIONS 

The definitions of a deficiency is as follows: 

A deficiency in internal control over financial reporting exists when the design or operation of a control 
does not allow management or employees, in the normal course of performing their assigned functions, to 
prevent, or detect and correct misstatements on a timely basis. A deficiency in design exists when (a) a 
control necessary to meet the control objective is missing or (b) an existing control is not properly 
designed so that, even if the control operates as designed, the control objective would not be met. A 
deficiency in operation exists when (a) a properly designed control does not operate as designed, or 
(b) the person performing the control does not possess the necessary authority or competence to perform 
the control effectively. 



APPENDIX B 



The table below provides the status of the FY 2012 management letter comments: 
Control Deficiencies: 



No. 


Prior Year Comments 


Elevated to 

Material 
Weakness 


Still Relevant 
and Repeated 


Adequately 
Resolved 


1. 


Budget Cost Level (BCL) ratings relied on 
inaccurate information 






X 


2. 


Inconsistency in BCL rating between Loans 
and Guarantees Accounting System (LGA) and 
the Asset Management System (AMS) 






X 


3. 


Inaccurate repayment schedule in the LGA 
System 






X 


4. 


Inaccurate information used for subsidy 
calculation — cash flow worksheet 






X 


5. 


Incorrect Accrual Status of Rescheduled Loans 
written off in prior years 






X 


6. 


Incorrect Pre-Credit Reform Allowance for 
Loan Loss journal entry 






X 


7. 


Incorrect Formula used in the Allowance 
calculation 






X 


8. 


Retention of Daily Security Monitoring report 






X 



Office of Inspector General 
Export-Import Bank of the United 
811 Vermont Avenue, NW 
Washington, DC 20571 
202-565-3908 
www.exim.gov/oig 



